Loading npm security reports…

codeam-cli@2.61.71: Malicious npm security report (Block) | LPM Firewall

registry / codeam-cli / 2.61.71

codeam-cli@2.61.71

Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.

AI Security Review

scanned 18d ago · by lpm-firewall-ai

On `codeam` start with a paired Claude session, the CLI harvests and uploads Claude credentials to the package backend. It also alters Claude instruction/onboarding control files during runtime.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs codeam after pairing a Claude session.

Impact

Transfers reusable Claude authentication material to a third-party backend and changes Claude behavior/trust state.

Mechanism

credential harvesting/exfiltration plus agent-control-file mutation

Attack narrative

The runtime reads ~/.claude/.credentials.json or ~/.config/claude/.credentials.json, then POSTs the raw credential to the Codeam credential-sync endpoint and watches those files for later changes. This begins automatically when a paired Claude session is started. The same start path also appends an instruction directing Claude to always use Codeam’s Beads workflow; non-local sessions mark Claude onboarding and workspace trust accepted.

Rationale

The package has a concrete credential-exfiltration path and runtime mutation of a foreign AI-agent control surface. Its harmless postinstall does not mitigate those activated runtime behaviors.

Evidence

package.jsondist/postinstall.jsdist/index.js

Network endpoints1

api.codeagent-mobile.com/api/plugin/agents/claude_code/credential-sync

Decision evidence

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/postinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/postinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = codeam-cli@2.53.0 matchedIdentity = npm:Y29kZWFtLWNsaQ:2.53.0 similarity = 0.933 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

7196// src/lib/git-branch.ts L7197: var import_child_process = require("child_process"); L7198: function detectCurrentBranch(cwd = process.cwd()) {

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L7196

9564if (process.platform === "win32") { L9565: return process.env.COMSPEC ?? "powershell.exe"; L9566: }

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L9564

7185process.stderr.write( L7186: "\n codeam-cli sends anonymous + identified usage events to PostHog\n (same project as the mobile + web apps). Opt out at any time:\n export CODEAM_TELEMETRY=0\n See https://... L7187: ); ... L7191: function vercelBypassHeader() { L7192: const token = process.env.CODEAM_VERCEL_BYPASS; L7193: return token ? { "x-vercel-protection-bypass": token } : {}; ... L7196: // src/lib/git-branch.ts L7197: var import_child_process = require("child_process"); L7198: function detectCurrentBranch(cwd = process.cwd()) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L7185

132stdioTransport.onmessage = (msg) => { L133: void httpTransport.send(msg).catch((e) => { L134: process.stderr.write(`[mcp-run http] send\u2192remote failed: ${String(e)} L135: `); ... L476: // fully documented, no reverse-engineering. OAuth `/login` (login-state at L477: // ~/.kimi-code/credentials/<name>.json, base https://api.kimi.com/coding/) L478: // is declared so it can land later without a wire change, but capturing ... L1367: // ⚠️ The instance MUST be PUBLICLY reachable (n8n.cloud or a public self-host) L1368: // — a localhost/private n8n can't be reached from the deploy box. L1369: enabled: true, ... L2050: function currentLevel() { L2051: if (process.env.CODEAM_DEBUG === "1") return LEVELS.trace;

High

Loopback Host Fingerprint Telemetry

Source collects a broad local host fingerprint and posts it to a fixed loopback listener.

dist/index.jsView on unpkg · L132

7184} L7185: process.stderr.write( L7186: "\n codeam-cli sends anonymous + identified usage events to PostHog\n (same project as the mobile + web apps). Opt out at any time:\n export CODEAM_TELEMETRY=0\n See https://... L7187: ); ... L7196: // src/lib/git-branch.ts L7197: var import_child_process = require("child_process"); L7198: function detectCurrentBranch(cwd = process.cwd()) {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L7184

132stdioTransport.onmessage = (msg) => { L133: void httpTransport.send(msg).catch((e) => { L134: process.stderr.write(`[mcp-run http] send\u2192remote failed: ${String(e)} L135: `); ... L476: // fully documented, no reverse-engineering. OAuth `/login` (login-state at L477: // ~/.kimi-code/credentials/<name>.json, base https://api.kimi.com/coding/) L478: // is declared so it can land later without a wire change, but capturing ... L1367: // ⚠️ The instance MUST be PUBLICLY reachable (n8n.cloud or a public self-host) L1368: // — a localhost/private n8n can't be reached from the deploy box. L1369: enabled: true, ... L2050: function currentLevel() { L2051: if (process.env.CODEAM_DEBUG === "1") return LEVELS.trace;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L132

1848var DEV_API_BASE_URL = "https://dev-api.codeagent-mobile.com"; L1849: function resolveApiBaseUrl() { L1850: const env = globalThis.process?.env; ... L2118: const tmp = `${debugFilePath}.${process.pid}.tmp`; L2119: fs.writeFileSync(tmp, header); L2120: fs.renameSync(tmp, debugFilePath); ... L7196: // src/lib/git-branch.ts L7197: var import_child_process = require("child_process"); L7198: function detectCurrentBranch(cwd = process.cwd()) {

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/index.jsView on unpkg · L1848

8676package = codeam-cli; repositoryIdentity = codeagent-mobile-clients; dependency = chokidar L8676: try { L8677: return require("chokidar"); L8678: } catch {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/index.jsView on unpkg · L8676

12804fs11.writeFileSync(this.helperPath, PYTHON_PTY_HELPER, { mode: 420 }); L12805: this.proc = (0, import_child_process7.spawn)(python, [this.helperPath, cmd, ...args2], { L12806: stdio: ["pipe", "pipe", "inherit"], ... L12819: \u2717 Failed to launch Claude Code: ${err.message} L12820: Make sure claude is correctly installed: npm install -g @anthropic-ai/claude-code L12821: `

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L12804

11}; L12: var __commonJS = (cb, mod) => function __require() { L13: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L11

132stdioTransport.onmessage = (msg) => { L133: void httpTransport.send(msg).catch((e) => { L134: process.stderr.write(`[mcp-run http] send\u2192remote failed: ${String(e)} L135: `); ... L476: // fully documented, no reverse-engineering. OAuth `/login` (login-state at L477: // ~/.kimi-code/credentials/<name>.json, base https://api.kimi.com/coding/) L478: // is declared so it can land later without a wire change, but capturing ... L1367: // ⚠️ The instance MUST be PUBLICLY reachable (n8n.cloud or a public self-host) L1368: // — a localhost/private n8n can't be reached from the deploy box. L1369: enabled: true, ... L2050: function currentLevel() { L2051: if (process.env.CODEAM_DEBUG === "1") return LEVELS.trace;

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L132

dist/vendor/node-pty/prebuilds/win32-arm64/pty.nodeView file

•path = dist/vendor/node-pty/prebuilds/win32-arm64/pty.node kind = native_binary sizeBytes = 293376 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/vendor/node-pty/prebuilds/win32-arm64/pty.nodeView on unpkg

Source & flagged code

15 flagged

package.jsonView file

Lines 4-44json

4 "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",

5 "type": "commonjs",

6 "main": "dist/index.js",

7 "bin": {

8 "codeam": "dist/index.js"

9 },

10 "files": [

11 "dist/index.js",

12 "dist/postinstall.js",

13 "dist/vendor",

14 "README.md",

15 "CHANGELOG.md",

16 "LICENSE"

17 ],

18 "scripts": {

19 "build": "tsup && node scripts/vendor-node-pty.js",

20 "dev": "tsup --watch",

21 "test": "vitest run",

22 "test:coverage": "vitest run --coverage",

23 "typecheck": "tsc --noEmit",

24 "postinstall": "node dist/postinstall.js || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L24

25 "prepublishOnly": "npm run build"

26 },

27 "keywords": [

28 "claude",

29 "claude-code",

30 "ai",

31 "ai-agent",

32 "ai-coding",

33 "ai-workflow",

34 "ai-workflow-continuity",

35 "async-ai-productivity",

36 "remote-ai-supervision",

37 "cli",

38 "developer-tools",

39 "devtools",

40 "codeagent",

41 "codeam",

42 "anthropic",

43 "openai-codex",

44 "cursor",

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = codeam-cli@2.53.0 matchedIdentity = npm:Y29kZWFtLWNsaQ:2.53.0 similarity = 0.933 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

7196// src/lib/git-branch.ts L7197: var import_child_process = require("child_process"); L7198: function detectCurrentBranch(cwd = process.cwd()) {

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L7196

9564if (process.platform === "win32") { L9565: return process.env.COMSPEC ?? "powershell.exe"; L9566: }

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L9564

7185process.stderr.write( L7186: "\n codeam-cli sends anonymous + identified usage events to PostHog\n (same project as the mobile + web apps). Opt out at any time:\n export CODEAM_TELEMETRY=0\n See https://... L7187: ); ... L7191: function vercelBypassHeader() { L7192: const token = process.env.CODEAM_VERCEL_BYPASS; L7193: return token ? { "x-vercel-protection-bypass": token } : {}; ... L7196: // src/lib/git-branch.ts L7197: var import_child_process = require("child_process"); L7198: function detectCurrentBranch(cwd = process.cwd()) {

dist/vendor/node-pty/prebuilds/win32-arm64/pty.nodeView file

•path = dist/vendor/node-pty/prebuilds/win32-arm64/pty.node kind = native_binary sizeBytes = 293376 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/vendor/node-pty/prebuilds/win32-arm64/pty.nodeView on unpkg